Trust Center

Documents for your security review

Tell us which deployment, controls and agreements you need to assess. We will confirm the available documents, their scope and any access requirements. Do not send patient data or credentials.

Request security documents · Read our Privacy Policy

Infrastructure with independent provider assurance

DentalXpand runs on Railway’s managed application infrastructure, with Supabase supporting its core database and data services. Our Railway application services and Supabase database are hosted in North American regions. Both providers publish SOC 2 Type II compliance information covering their assessed services.

Our security foundation combines independently assessed infrastructure providers with DentalXpand’s application-level access controls, encryption and security testing. Provider SOC 2 reports cover their respective services. An independent SOC 2 Type II examination is part of DentalXpand’s security roadmap. We plan to pursue this assessment and publish an update here upon completion.

Layered data protection

• Encryption at rest: Supabase states that customer data on its platform is encrypted at rest with AES-256. DentalXpand’s PMS credential and imported source-snapshot components additionally use AES-256-GCM encryption.
• Transport protection: HTTPS and TLS protect supported connections. Protocol support and configuration depend on the endpoint and connected provider.
• Protected integration credentials: Sensitive connection settings are handled through restricted backend paths rather than ordinary browser-facing settings.

During setup, we review where data travels, which integrations are enabled and how the deployment is configured. A provider’s encryption statement does not cover every downstream export or customer-managed device.

Access scoped to your organization and practice

DentalXpand’s access architecture combines authenticated users, role and permission checks, organization and practice scoping, PostgreSQL row-level security policies and private-file access policies. These controls are designed to limit access to the workspace and actions a user is authorized to use.

Two-factor authentication is required for every administrator account, including users newly assigned an administrator role. Protected platform-administration functions also include elevated authorization checks. Administrative audit records help support investigation and accountability for covered actions.

• Inactive sessions automatically lock after 30 minutes.
• After three incorrect password attempts, sign-in is blocked until the user resets their password through the Forgot Password flow.

Training, support and billing staff receive access according to their assigned roles. These staff members are not granted direct administrative access to production servers, databases or source-code repositories. They cannot sign in as clients or directly change client passwords; they can send invitations or password-reset links to the client’s registered email address.

Customer administrators should check permissions when roles change and remove access when people leave. They should also confirm who can manage integrations, exports and sensitive workflows.

Confirm the healthcare-data setup before connecting

Xpand Technology LLC signs Business Associate Agreements for applicable services. Contact support@dentalxpand.io to arrange the required agreement before enabling workflows involving PHI.

Before protected health information (PHI) enters a workflow, confirm the authorized use, applicable Business Associate Agreement (BAA), selected services and required safeguards. Hosting-provider compliance alone does not establish that a particular deployment is ready to receive PHI.

• Confirm each connection’s provider, purpose, data categories and permitted actions.
• Use approved secure setup channels for credentials and patient information.
• Review AI and document-extraction outputs before material healthcare, payment or employment decisions, as described in our Terms.

Keep patient data out of public forms. Do not send PHI, passwords, API keys or financial-account details through our website inquiry form or ordinary email.

Your data, privacy choices and retention

Customers control the records they place in their workspace and the users, integrations and workflows they authorize. Our Privacy Policy explains information use, connected services, AI-assisted features and rights requests.

Retention, deletion and export arrangements depend on the applicable agreement, data type, customer configuration and legal obligations. Removing an integration does not automatically erase records already received by another service.

Read our Privacy Policy · Read our Terms and Conditions

Official HIPAA guidance for your evaluation

Use these U.S. Department of Health and Human Services resources when reviewing your organization’s responsibilities and the proposed deployment.

• HIPAA Security Rule overview — administrative, physical and technical safeguards for electronic protected health information.
• HIPAA risk analysis guidance — identifying and assessing risks to electronic protected health information.
• Business associates and BAAs — business-associate roles and agreement responsibilities.
• HIPAA and cloud computing — cloud-provider responsibilities, BAAs and shared safeguards.

These resources explain general requirements. Linking to them does not imply government endorsement or certify DentalXpand’s compliance.

Have a security question?

DentalXpand has engaged external security-testing firms for penetration testing. An assessment applies to the systems and scope tested at that time.

Send your business security questions or procurement requirements to support@dentalxpand.io. Tell us which controls and provider documents you need to review, and the deployment you are considering for your practice, billing company or DSO.

To report a suspected vulnerability, use the same address with the subject “Security report.” Start with a brief description and affected feature; request a secure channel before sharing sensitive evidence.

For privacy questions or rights requests, contact contact@dentalxpand.io.